September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-13683 An improper neutralization of special elements used in an SQL command ('SQL Inje... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13666 An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in... |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88844 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not ver... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89007 The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89008 The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81340 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
low | 3.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84903 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform a... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84904 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform p... |
low | 3.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-68493 After guessing a 62^15 complex unique identifier, a malicious logged in user was... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93394 A flaw in libmongoc's SCRAM authentication implementation caused the client to c... |
low | 3.7 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-93378 Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93380 Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93384 Server-side request forgery in Omnibox in Google Chrome on on Android prior to 1... |
low | 3.7 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-45723 Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. |
low | 2.7 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-85716 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-75588 Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme wh... |
low | 2.6 | — | Mattermost / mattermost desktop | 2026-09-17 | 2026-10-13 |
| CVE-2026-61700 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-12284 Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender i... |
low | 3.7 | — | Mattermost / mattermost desktop | 2026-09-17 | 2026-10-13 |
| CVE-2026-91017 The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91008 The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86446 The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness f... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87836 The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its... |
low | 2.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20071 A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92474 A security flaw has been discovered in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87026 Tanium addressed an improper access controls vulnerability in Threat Response. |
low | 3.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92418 A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034... |
low | 3.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92472 A vulnerability was determined in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92473 A vulnerability was identified in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86071 Junrar is an open source Java RAR archive library. |
low | 3.7 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-73442 On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP... |
low | 3.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87031 n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /c... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-69200 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
low | 3.7 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92385 A vulnerability has been found in SourceCodester Online Food Ordering System 1.0... |
low | 2.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92381 A weakness has been identified in PbootCMS up to 3.2.22. |
low | 3.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92130 Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set... |
low | 3.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92359 A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. |
low | 3.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77860 In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the '... |
low | 3.7 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-89327 The FluentBoards WordPress plugin before 2.0.15 does not verify that a board mem... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-89328 The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86448 The LearnPress WordPress plugin before 4.4.7 does not perform any authentication... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.